Cisco IronPort

Copyright-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to PureRAT.

WeTransfer-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an archive containing a Malicious Batch Script and several files, including legitimate ones, via an embedded URL. The Malicious Batch Script runs an AutoIT Script which runs XWorm RAT in memory.

United States Courts-spoofing, legal-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a JSDropper that delivers ConnectWise RAT.

Travel assistance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to an archive file that contains an LNK file. When run, the LNK file downloads a PowerShell script that runs TONResolver.

Shipping-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a virtual hard drive file that contains Moixd Stealer.

Finance-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an attached PDF with a link to download an LNK Downloader. The LNK Downloader delivers a Malicious Downloader which delivers a Malicious Batch Script which delivers a PowerShell Script. The PowerShell Script runs DcRAT, PureRAT, and XWorm RAT in memory.

Resume-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver a malicious Visual Basic Script via an embedded link. When run, the script delivers repurposed Nirsoft password recovery tools via a Malicious Downloader and a Cryptocurrency Coin Miner.

Response-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a archive file that contains an LNK file that downloads a PowerShell script. The script is used to download a NodeJS runtime environment that runs TONResolver.

Zoom-spoofing, response-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to a fake Zoom call that redirects to a fake Microsoft Store site that delivers a VBS script. The script delivers Rodex RMM or ConnectWise RAT.

NMLS-spoofing, notification-themed emails found in environments protected by Cisco IronPort deliver a Malicious Batch Script via an embedded URL. The Malicious Batch Script then delivers ConnectWise RAT.

Social Security-spoofing, benefits-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver an embedded link to Techinline FixMe.IT.

Social Security-spoofing, document-themed emails found in environments protected by Cisco IronPort and Microsoft ATP deliver a VBS via an embedded URL. The VBS delivers ConnectWise RAT.